Privacy Policy

Responsible party and Information Officer

Hearth & Co (Pty) Ltd is the responsible party for personal information processed through this website.

Hearth & Co's Information Officer is registered with the Information Regulator under certificate #2026-061839.

Privacy requests can be sent to hello@hearthco.co.za.

Information we collect

Depending on how you use the store, we may collect:

• Name, email address, phone number, and delivery address.
• Account registration and login-related information.
• Order, cart, payment status, refund, return, and support records.
• Marketing-consent preferences where you choose to provide them.
• Technical information needed to keep the site secure, reliable, and measurable.

How we use information

We use personal information to:

• Process orders, payments, deliveries, returns, and refunds.
• Provide customer support and order updates.
• Manage customer accounts and saved delivery details.
• Send transactional emails and service messages.
• Send marketing only where consent has been given.
• Protect the store from fraud, misuse, and security incidents.
• Meet legal, accounting, tax, and consumer-protection obligations.

Who we share information with

Hearth & Co shares personal information only where needed for a legitimate store purpose. This may include:

• Payment providers such as PayFast.
• Approved suppliers and couriers for order fulfilment.
• Email providers for transactional and support messages.
• Hosting, database, analytics, and error-monitoring providers.
• Professional advisers or authorities where legally required.

Supplier data sharing is limited to what is needed to fulfil the order.

Cross-border data transfers

Hearth & Co's service providers, including email, are South African. Your personal information is not transferred outside South Africa.

Marketing consent

Marketing consent is opt-in. Hearth & Co does not pre-tick marketing consent boxes. You can ask to stop receiving marketing messages. Transactional and service messages may still be sent where needed to complete or support an order.

Security and retention

Hearth & Co uses reasonable technical and organisational safeguards to protect personal information. No online system is risk-free, but access should be limited to people and services that need it.

Retention periods depend on the type of information:

• Order, payment, invoice, refund, and return records: 7 years from the order date, in line with SARS and Companies Act recordkeeping requirements.
• Account registration and login information: for as long as the account is active, plus 3 years after account closure.
• Marketing consent and preferences: until you withdraw consent, or reviewed and removed automatically after 3 years of no engagement.
• Support and warranty case records: the applicable warranty period plus 1 year.
• Technical and security logs: 12 months.

Your privacy rights

You may ask Hearth & Co to confirm what personal information is held about you, request correction where information is wrong, object to certain processing where the law allows, or ask for deletion where retention is no longer required.

Requests can be sent to hello@hearthco.co.za.